Ofcom information notice enforcement: sections 135 and 137A
In short: An Ofcom information notice under section 135 or section 137A of the Communications Act 2003 carries a maximum penalty of £2 million, plus £500 per day for continuing contraventions, enforced through the section 138 contravention process. Five enforcement cases since 2021 (Colt, BT/Connected Nations, TikTok, Meta and the new BT investigation opened on 29 April 2026) show the regime in consistent use.
Ofcom opened an investigation into BT plc on 29 April 2026 over the completeness and accuracy of information that BT entities provided in response to formal notices issued under section 137A of the Communications Act 2003. The case puts the spotlight back on a part of the regulatory framework that operators rarely think about until it bites: the statutory duty to respond to a regulator’s information notice with complete and accurate data, on time, and the consequences of getting it wrong. Five years of enforcement decisions tell the same story.
Key findings: Ofcom information notice enforcement since 2021
- 11 October 2021: Colt Technology Services Group fined £15,000 (25% settlement discount) for contravening section 135(4) of the Act between 26 June 2020 and 4 January 2021. Notice issued for the Wholesale Fixed Telecoms Market Review. Source: Ofcom Confirmation Decision, case CW/01257.
- 30 July 2021: BT fined £42,500 (15% settlement discount) for inaccurate information provided under section 135 about EE Fixed Wireless Access coverage, used in the Connected Nations 2019 report. Source: Ofcom Confirmation Decision, case CW/01253.
- 23 July 2024: TikTok fined £1,875,000 (25% settlement discount) for inaccurate data provided in response to information requests under sections 368Z10 and 368Y of the Act, the parallel video-sharing platform information limb. Source: Ofcom news release.
- 23 January 2026: Ofcom opened an investigation into Meta Platforms Inc. over information provided under section 135 notices dated 31 July 2024 and 19 June 2025 in connection with the retail business messaging market and the Wholesale A2P SMS Termination Market Review. Source: Ofcom case CW/01329/11/25.
- 29 April 2026: Ofcom opened an investigation into BT plc concerning compliance by EE Limited and Plusnet plc with section 137A notices issued on 7 December 2023, sought to inform the 2025 Comparing Customer Service Report. Source: Ofcom case CW/01337/03/26.
| Year | Subject | Statutory basis | Outcome |
|---|---|---|---|
| 2021 | Colt Technology Services | s.135 CA 2003 | £15,000 confirmation decision (25% settlement discount) |
| 2021 | BT (Connected Nations 2019) | s.135 CA 2003 | £42,500 confirmation decision (15% settlement discount) |
| 2024 | TikTok | ss.368Z10/368Y CA 2003 (VSP regime) | £1.875m final decision (25% settlement discount) |
| 2026 | Meta (WhatsApp Business) | s.135 CA 2003 | Open investigation (case CW/01329/11/25) |
| 2026 | BT plc (EE / Plusnet) | s.137A CA 2003 | Open investigation (case CW/01337/03/26) |
The statutory framework for an Ofcom information notice
The Communications Act 2003 gives Ofcom three principal information powers, supplemented by the section 7 publication duty. Section 135 is the general information-gathering power: Ofcom may require a person to provide all such information as Ofcom considers necessary for the carrying out of any of its functions, by notice, within a stated period and in a stated form. Section 136 gives a parallel power for proceedings. Section 137A is narrower and publication-oriented: Ofcom may require a communications provider either to publish information held by the provider, or to provide it to Ofcom for publication. The section 137A power may be exercised only in connection with Ofcom’s functions under Part 1 (so far as relating to electronic communications) or under Chapter 1 of Part 2 of the Act, and only in a way that is proportionate to the use the information will be put to. Before serving a section 137A notice Ofcom must serve a draft on the provider and consider any representations made within the period for response.
The publication duty in section 7 requires Ofcom to publish such information as it considers appropriate to assist consumers in making informed choices. The Comparing Customer Service Report is the most visible expression of that duty in the retail telecoms market. Data that goes into the report flows from section 137A notices to providers; the integrity of the report depends on the integrity of those returns.
The current BT investigation, opened on 29 April 2026, concerns notices issued on 7 December 2023 to EE Limited and Plusnet plc requiring data on customers’ fixed voice and fixed broadband ordering experience to inform the 2025 Comparing Customer Service Report. Ofcom states that some of the information provided in response to those notices may not have been complete and accurate. The case reference is CW/01337/03/26. No characterisation has been made of BT’s conduct and the company has had no opportunity yet to make representations.
How Ofcom enforces an information notice contravention
Section 138 sets the contravention machinery for sections 135, 136 and 137A. Where Ofcom determines that there are reasonable grounds for believing that a contravention has occurred or is occurring, it may serve a notification setting out its determination, the requirement contravened, the period for representations, what the person must do to comply and any proposed penalty. Where the contravention is serious, the notification may also specify a direction Ofcom is minded to give under section 140. Section 139 sets the maximum penalty at £2 million for a single contravention, and a further £500 per day in the case of a continuing contravention after a section 139A confirmation decision requires immediate action or compliance within a specified period.
Settlement is part of the picture. Ofcom’s Enforcement Guidelines provide for a streamlined procedure where the subject acknowledges the breach, with discounts of 15 to 30 per cent in the closed cases. Ofcom’s Penalty Guidelines set a five-step calculation: starting amount based on relevant turnover, adjustments for seriousness and aggravating or mitigating factors, deterrence, settlement discount and a check for proportionality. The Communications Act 2003 caps the headline penalty for an information-requirement contravention at £2 million; turnover-linked caps apply to other contravention categories.
The arc is long. The 2021 confirmation decision against BT in the Connected Nations 2019 case followed a notice issued in September 2019 and an investigation opened in March 2020. The Colt case followed the same general timeline. The current BT investigation runs against notices issued in December 2023, with the formal investigation opened more than two years later. Boards plan on the basis that information-notice contraventions can surface long after the underlying notice is closed.
Operational implications for communications providers
The recurring fact pattern is that responses turn out to be incomplete or inaccurate, often after the regulator has already used the data for a published purpose. The harm to Ofcom is that the underlying piece of regulatory work is contaminated; the harm to the provider is the cost and disruption of the investigation and the reputational consequences of a published confirmation decision.
Three operational priorities follow. First, treat every formal notice as a board-level controls obligation. The signing officer’s certification, that the response is complete and accurate to the best of the provider’s knowledge and belief, is not a formality. Second, build a documentary audit trail. The drafting iterations, the data sources used, the assumptions made, the limitations flagged to Ofcom, and the sign-off chain should all be retrievable two years later. Third, prefer early correction to late discovery. The TikTok and BT/Connected Nations cases turned in part on the gap between the inaccurate response and the date the inaccuracy was disclosed; the Colt case turned on Colt twice confirming incorrect information before correcting it. A prompt notification to Ofcom that an earlier response was wrong does not eliminate exposure but consistently produces a better outcome than the alternative.
For the broader Ofcom enforcement context, see our prior analysis of Ofcom enforcement under the Online Safety Act and the firm’s view on what Sir Ian Cheshire’s appointment signals for operators. Both pieces speak to the same direction of travel: a regulator that has rebuilt the enforcement function and that is using its statutory toolkit across all four corners of its remit. Where the firm is engaged on these matters is set out on our investigations and enforcement support page.
Viewpoint
Information notice integrity is the regulatory plumbing that allows everything else Ofcom does. Market reviews, comparators, complaint analysis, USO eligibility, spectrum management and security oversight all depend on the data that providers return in response to formal notices. A regulator that cannot rely on its data set cannot meet its statutory functions. The pattern of cases since 2021, Colt under the Wholesale Fixed Telecoms Market Review, BT under Connected Nations, TikTok under the video-sharing platform information limb, Meta under the messaging market monitoring, and now BT under the Comparing Customer Service Report, shows that Ofcom treats data quality contraventions as a sustained enforcement priority rather than an episodic one. Penalties have ranged from £15,000 to £1.875 million; the ratio reflects relevant turnover and seriousness, not the regulator’s appetite. The next case will not be the last.
In our experience advising operators on information-notice responses, the work commonly turns on both the legal scope of the notice and the operational data-quality controls behind the response. The operational element, federated data systems, multiple licensed entities within a group, and the gap between the operational team’s reading of the question and the answer Ofcom is seeking, is where most attention is needed. The legal-interpretation work, on the scope and limits of the notice itself, often shapes how the operational task is framed.
Frequently asked questions
What is the difference between section 135 and section 137A of the Communications Act 2003?
Section 135 is Ofcom’s general information-gathering power. Ofcom may require any person to provide information necessary for the carrying out of any of its functions. Section 137A is narrower and publication-oriented: Ofcom may require a communications provider either to publish information itself, or to provide information to Ofcom for publication. Both powers are enforced through the section 138 contravention machinery and carry the same headline penalty cap of £2 million under section 139.
What is the maximum penalty for failing to comply with an Ofcom information notice?
Section 139 of the Communications Act 2003 caps the headline penalty at £2 million for a single contravention of a requirement imposed under section 135, 136 or 137A. A further £500 per day applies in the case of a continuing contravention after a section 139A confirmation decision requires immediate action or compliance within a specified period. Settlement discounts of 15 to 30 per cent are available where the subject acknowledges the breach.
What does Ofcom do when it suspects an information-notice contravention?
Where Ofcom has reasonable grounds for believing that a contravention has occurred, it serves a notification under section 138 setting out its determination, the contravention identified, the period for representations, what the subject must do to comply, and any proposed penalty. The subject has the right to make written representations and, in serious cases, the notification may specify a direction Ofcom is minded to give under section 140. The process ends in a confirmation decision under section 139A.
How long does an Ofcom information-notice investigation take?
The recent track record points to a long arc. The 2021 confirmation decision against BT followed a notice issued in September 2019 and an investigation opened in March 2020. The current investigation into BT runs against notices issued in December 2023, with the formal investigation opened more than two years later. Providers retain working papers and the audit trail for any information-notice response well beyond the date of the response itself.
What is the practical lesson for in-house regulatory teams?
Treat the information-notice response as a board-level controls obligation, not a back-office return. Build a documentary audit trail covering data sources, assumptions, limitations and sign-off. Where an earlier response is found to be inaccurate, prompt voluntary disclosure to Ofcom is consistently the better path. Federated data systems and group structures create the operational risk; closing the gap between what frontline data owners think the question means and what Ofcom actually wants is where most of the work sits.
For advice on responding to a section 135 or section 137A notice, or on the section 138 enforcement process, contact Rob Bratby at Bratby Law.
